VulnCheck's own sinkhole produced the sharpest number in the disclosure and also the least representative one. SPEAKINGSTONE carries a hardcoded backup C2 domain that it reaches only where a primary server was never configured; the domain was unregistered, so VulnCheck registered it, stood up a reverse-engineered implementation of the protocol, and beacons began arriving as soon as the server was live [13]. By August 21, 392 unique devices had checked in, 390 of them in China [14], which leaves two outside it [2]. Of those, 363 self-reported the model L3_V2_8 on firmware 3.0.0.4.528 [15], or 92.6 percent of the sample [1]; 304 broadcast SSIDs beginning "CMCC" [15]; 83 percent sat on China Mobile's network [15], roughly 325 hosts [3]. Only units that were never given a primary C2 ever dial the backup, so the 392 is a floor drawn from an unrepresentative subset [16].
The version data is what turns this into a procurement decision. The advisory pages present affected builds as upper bounds, the CVE records name each firmware as a single exact build and set every other version's status to unknown, and no fixed release is named in either advisory [10]. An owner running a build outside the listed set has no published basis for deciding whether the implant is there.
Several entries in both CVE records sit under an unidentified vendor [17], so the published model lists are not the full set of names this firmware ships under. The Hacker News checked the IEEE-registered MAC prefix database on August 28 and found the blocks 78:A3:51 and F8:5E:3C both assigned to Shenzhen Zhibotong Electronics [12], and ZBT sells the same hardware and firmware to resellers that put their own name on the case [11]. The MAC address a device broadcasts identifies who built it more reliably than the brand printed on the case.
ENDLESSDOORS, the phone-home implant VulnCheck disclosed on August 5 in at least 20 Zbtlink models, is tracked as CVE-2026-66747 [9]. SPEAKINGSTONE's supported message types matter more than its CVSS rating: arbitrary command execution as root, exfiltration of the WAN PPPoE username and password, read and write access to a DNS hijack list, and a reverse SSH tunnel [5]. VulnCheck describes it as "a surveillance implant with root access to every device it runs on" [18]. The PPPoE credentials and the DNS list are the subscriber-facing attack; the tunnel is how an operator reaches whatever sits behind the router.
